dissection of a Cyber- Espionage attack

Patient Zero
How the victim discovers the problem
The diplomatic representation in Addis Ababa is composed of few militaries and
several diplomats connected to Internet with the standard VPN service from public
networks (transit through the Base). For that part, nobody has noticed the strange
connections to the external C2s repeated each day.
But for a specific task, the owner of the infected laptop has used a connection from
a military outpost, tightly regulated in access time and permissions.
Once connected, the computer has attempted to beacon to the C2s and the local
network operator has identified the strange traffic signaling it to his superiors.
The alert has escalated to the Army regiment which has started to investigate.
The analysis performed has followed the traditional practice.
#RSAC